Privacy policy

Data we use

• Account information. When you choose Google sign-in, Google and our sign-in provider, Supabase, process your account identifier, email and basic profile information, such as your name and profile picture. Existing accounts can also sign in with an email and password, which Supabase verifies. The app does not store that password. Stocks2Hold uses your account identifier to keep your data separate and your email to show which account is signed in. We do not receive your Google password.
• Saved stocks and research. We store the tickers you save, purchase prices, stop-loss and optional target prices you enter, saved analysis results and their dates. A saved position is information you enter, not a verified brokerage holding. Analyses can be saved to your history even when you do not add a position.
• Sign-in and technical information. A sign-in credential is kept in your device's protected storage so you can remain signed in. Our service providers and server can process IP addresses, request times, requested pages or stock symbols, response codes and diagnostic information to operate the service.
• Messages you send us. If you contact us, we receive your email address, message and any attachments you choose to send.

Providing an account is necessary to use the signed-in app. Saving positions and sending support messages are optional. This beta has purchases disabled and does not collect payment-card or brokerage-login details. We do not sell your personal data or use advertising trackers.

Why we use it

We use your account and saved research to provide the service you request: sign-in, access to your own stocks and history, and account deletion. The legal basis is performing our agreement with you to provide these features.

We use necessary technical information, backups and deletion records to keep the service reliable, protect accounts and prevent deleted data from being recreated. We handle support messages to answer your request. These uses rely on our legitimate interests in operating a secure service and assisting its users; you may object as described below.

Stock assessments are calculated automatically from market data and the levels you enter. They concern stocks and do not place orders, assess your creditworthiness or make eligibility decisions about you.

Service providers and data locations

Saved research is stored on the server operated for Stocks2Hold. We use the following external services where needed:

• Google handles Google sign-in. Google also processes messages sent to our Gmail contact address. See Google's privacy policy and its Google sign-in information.
• Supabase manages sign-in accounts and sessions. See Supabase's privacy information and data-processing terms.
• Cloudflare routes and protects the app's HTTPS traffic. API requests, including the information in those requests, pass through its infrastructure. See Cloudflare's privacy policy and data-processing terms.
• Superwall provides the purchase screen and processes technical information and purchase-screen interactions when it is used. The account identifier is used to keep access associated with the right account. See Superwall's privacy policy.

Purchasing remains disabled in the current beta while setup is completed. When enabled, Google Play will handle checkout and RevenueCat will verify purchase receipts, product identifiers and Pro access for your account. We do not receive your payment-card details. See RevenueCat's privacy policy.

The analysis server also requests public market information, currently from Yahoo Finance through yfinance and public insider-trading sources. It sends stock identifiers for these requests; it does not send your sign-in credentials or saved price levels to those market-data sources.

Our infrastructure providers operate internationally and use subprocessors. Processing may therefore take place outside the EU/EEA. Their linked terms describe the transfer safeguards they offer, including standard contractual clauses where applicable. Contact us for information about the arrangements relevant to your data. We do not promise that all processing stays within the EU.

Retention and account deletion

Account information and personal analysis history are kept while your account exists. Saved positions and watchlist entries remain until you remove them or delete the account. Removing a saved stock does not remove its past analysis history.

Use Delete account in the app's Saved tab, or use the account-deletion website. Deletion removes your sign-in account and live saved positions, watchlist and personal analysis history. It does not delete your Google account. If a deletion cannot finish because a service is unavailable, sign in again and retry, or contact us.

Daily backups are normally retained for 14 days. A copy made before deletion may contain your data until it is rotated out. If a backup job fails, an older recovery copy can be kept longer. Current deletion records are applied before recovered data is used again.

We retain a minimal account-ID deletion marker without a fixed expiry to prevent delayed requests or recovery from recreating deleted account data. Operational and provider logs have separate retention rules; the beta does not currently have one fixed maximum age covering all such logs. Support messages are kept for handling your request and necessary follow-up, or longer if needed to resolve a dispute or meet a legal obligation.

Device and browser storage

The app keeps its sign-in credential in protected device storage and removes it when you sign out. The account-deletion website uses temporary storage in your browser tab to complete Google sign-in. It does not store a reusable login in the browser's persistent local storage. Google and infrastructure providers may use their own cookies or security storage under their policies.

This privacy page has no analytics scripts, advertising cookies or sign-in requirement.

Your rights

Depending on the circumstances, you can request access to your personal data, correction, deletion, restriction of processing or a portable copy. You may object to processing based on legitimate interests. Email drimwiv@gmail.com from the address associated with your account. We may need to verify your identity before acting on a request.

You may complain to the Swedish Authority for Privacy Protection, IMY, or the data-protection authority where you live or work. IMY recommends contacting the organisation first, particularly for requests to exercise your rights.

Changes to this policy

We update this page when the service or its data use changes. The date above identifies the current version. Material changes will be explained in the app or through an appropriate contact channel.